Who Is Accountable When an AI Agent Makes a Business Decision?

As businesses increasingly adopt agentic AI, we're entering an interesting area of corporate governance.

AI agents can now execute workflows, access sensitive information, interact with enterprise systems, and make decisions with limited human intervention.

But who is accountable when an autonomous AI agent makes a costly mistake, exposes confidential information, or takes an unauthorized action?

In the fourth edition of Corporate Governance: A Board Director's Pocket Guide, which I co-authored with Annie Choi, we explore how AI, cybersecurity, and emerging technologies are reshaping corporate board responsibilities.

Traditional corporate governance frameworks emphasize oversight, risk management, accountability, and fiduciary responsibility. Agentic AI introduces new challenges because decisions and actions can occur without direct human involvement.

This raises several questions:

• Should corporate boards establish dedicated AI governance committees?
• Should AI oversight remain within existing cybersecurity and enterprise risk management functions?
• How much autonomy should organizations grant AI agents before requiring human approval?
• Who bears responsibility when an AI agent's actions cause financial or reputational damage?

My question for the Lounge.ai community:
As agentic AI becomes more integrated into business operations, are existing corporate governance structures sufficient, or do we need an entirely new approach to AI oversight?

I'd be interested in hearing perspectives from founders, executives, board members, and AI developers.

For those interested in the broader governance discussion: ericyocam.com/pocket-guide.html